> For the complete documentation index, see [llms.txt](https://smadi0x86-blog.gitbook.io/smadi0x86-playground/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://smadi0x86-blog.gitbook.io/smadi0x86-playground/certifications/certified-kubernetes-security/certified-kubernetes-security-5.md).

# System Hardening

## System Hardening

### AppArmor

AppArmor is a layer of security that sits between applications and our system filesystem, proceeses and networks.

We can do profiles for the applications we wanna apply AppArmor on.

We can create profiles for firefox, kubernetes, kubelet etc...

#### Types of profiles

#### Main commands

#### Setup simple AppArmor profile for curl

We can run `aa-genprof curl` to generate a profile for curl, then we can check if its added by going to `/etc/apparmor.d/` or running `aa-status`.

We can use `aa-logprof` which checks the logs and update our profil according to the logs.

#### Nginx docker container uses AppArmor profile

We can apply an apparmor profile definition using `apparmor_parser --add <path-of-profile>` and we got it from [https://kubernetes.io/docs/tutorials/security/apparmor/.](https://kubernetes.io/docs/tutorials/security/apparmor/)

We have a pre-created profile called `docker-nginx` so we will apply it, this profile restricts some stuff as shown below and we can confirm its added by running `aa-status`

Then to test our new profile we can create an nginx container that uses our profile `docker run --security-opt apparmor=docker-nginx -d nginx` and then `docker exec -it <container-id> sh`.

The name of the profile isn't the name of the file, but its the name specified inside the file.

#### Create pod which uses an AppArmor profile

<https://kubernetes.io/docs/tutorials/security/apparmor/>

Prior to v1.30, this was created using annotations.

### Seccomp

#### Create nginx pod in kubernetes and assign a seccomp profile to it

<https://kubernetes.io/docs/tutorials/security/seccomp/>

We have a pre-created seccomp configuration, we will add it to `/var/lib/kubelet/seccomp/profiles/default.json` on the worker node.

Now, we create a pod and add the profile path.

We can exec and it works!

Now, we will remove write syscall from the seccomp `default.json` profile and see what happens.

```
Error: failed to start containerd task "seccomp-pod": OCI runtime start failed: cannot start an already running container: unknown
```

It is not working as the container can't write and create the nginx service!

### Minimize OS Footprint

Running `netstat -plnt | grep 22` or `lsof -i :22` to check for ssh listening connections and open ports.